Maya may read but not delete. Which question is that?
- Authorisation
- Authentication
- Amortisation
Which question is authentication?
- Who are you
- What may you do
- What time is lunch
Passwords may be stored as plain text for speed.
Circle one: True False
What does the per-user salt add?
- A second password to remember
- A random extra mixed in per person
- A faster login screen
The login server cannot be reached. What should each part do?
- Wave everyone through
- Stay at no until the check recovers
- Delete the user list
Why must the hashing method be deliberately slow?
- So each guess costs the attacker costly time
- So logins feel important
- So servers stay warm
A signed-in owner opens someone else's pay record. Which check failed?
- Authentication, since nobody signed in
- The clock on the wall
- Authorisation, since identity was already proved
A rota reader touches pay files it never needs. What changes?
- It gains every file for safety
- Nothing, extra access is harmless
- It loses pay files and the master key
Who you are, then what you may do W1-mt_ofIiD4Bbpk-s1
- Authorisation · Limits after identity is known are authorisation, like the guest list.
- Who are you · Authentication checks identity before anything else is decided.
- False · Plain text hands every password to whoever steals the list.
- A random extra mixed in per person · The random extra makes each stored hash unique per person.
- Stay at no until the check recovers · Failing closed keeps the doubt on the safe side until checks return.
- So each guess costs the attacker costly time · Slow hashes price every guess, which blunts stolen lists.
- Authorisation, since identity was already proved · Identity held, so the broken part is the limit on what follows.
- It loses pay files and the master key · Least privilege strips each unneeded touch and names the removal.